News for hackers. Stuff that matters.
Re:London's Oyster card: Are its days numbered? by usrnm on Friday September 10, 2021 @05:03PM (#28486866)
If you paid for it with your credit card, then it certainly is linked to your name. And not a lot of people use cash these days
Re:London's Oyster card: Are its days numbered? by tialaramex on Friday September 10, 2021 @08:42PM (#28488425)
You can fill an anonymously purchased Oyster with actual coins at select locations. I used to fill mine with otherwise useless small change periodically. In this way the Oyster is not tied to a credit card, although of course TFL does have CCTV so if they really wanted to (e.g. you murder somebody and leave the card at the scene) they could trawl through the CCTV footage matching the times the card was used.
Re:London's Oyster card: Are its days numbered? by bobthepanda on Friday September 10, 2021 @06:02PM (#28487403)
It’s still nice for people who may not have (local) bank accounts, namely poor people and tourists.

IIRC you can’t have a WeChat pay account without a Chinese bank account.

Re:London's Oyster card: Are its days numbered? by tialaramex on Friday September 10, 2021 @08:48PM (#28488464)
Most tourists should find their contactless card or equivalent (e.g an iPhone) just works. There may be a brief extra pause, especially the very first time you touch a gate, as the system figures out that yes this is a payment card, and yes it can afford to pay for a journey on the network. So, probably don't choose peak time at a crowded station to find out if your card or phone works.

I would much prefer if this was true for most public transit networks in the world, including the rest of the UK.

Re:London's Oyster card: Are its days numbered? by MillenialMan on Saturday September 11, 2021 @04:51AM (#28490445)
Many banks charge a hefty premium for overseas purchases, and they tend to charge per purchase.
Re:London's Oyster card: Are its days numbered? by Nextgrid on Saturday September 11, 2021 @09:44AM (#28491922)
TfL settles every 24 hours, so you'll only have a single purchase per 24H regardless of how many journeys you've taken.

I'd also argue that in this case the fault is on the cardholder for being with a shit bank when better options exist in the vast majority of countries.

Re:London's Oyster card: Are its days numbered? by MillenialMan on Sunday September 12, 2021 @01:31PM (#28503060)
I think that's an absurd requirement to levy on tourists and oyster cards are a perfectly reasonable solution.
Re:London's Oyster card: Are its days numbered? by bobthepanda on Sunday September 12, 2021 @11:10PM (#28507477)
That would be most American banks.
Re:London's Oyster card: Are its days numbered? by pfranz on Saturday September 11, 2021 @06:06AM (#28490734)
I'm from the US and haven't had great luck in Europe. One card ditched "travel alerts" in 2016, the other I swore added one when it saw I purchased plane tickets, but it didn't. Both got flagged causing problems. One card I specifically got because it had no foreign transaction fees and was recommended for traveling. Only one of my cards is contactless and I about every 4th or 5th transaction I get flagged and they need to enter info from my ID to complete the transaction. For a lot of services that require preauthorization just don't work and don't give clear error messages.

Even if my card worked the first time I wouldn't trust it would work the 3rd or 4th. Until I bought a monthly pass every trip took time and some luck. I wish I knew prepaid cards were an option.

Re:London's Oyster card: Are its days numbered? by afarrell on Saturday September 11, 2021 @05:32AM (#28490620)
The US does not have contactless credit cards. Britain has a financial and national security interest in American tourists — who will need oyster cards.
Re:London's Oyster card: Are its days numbered? by vegasea on Saturday September 11, 2021 @05:54AM (#28490697)
That is false. The US absolutely does have contactless credit cards.
Re:London's Oyster card: Are its days numbered? by ryanlol on Saturday September 11, 2021 @05:47AM (#28490670)
Wait, what? All my US cards except for the metal amexes have been contactless for years. All of them also support apple pay.
Re:London's Oyster card: Are its days numbered? by pfranz on Saturday September 11, 2021 @05:57AM (#28490704)
I have 2 Mastercards and 1 Visa. Only one of the Mastercards support contactless. The one without foreign transaction fees doesn't. It's also been vary hard to find a chip+pin card (without an annual fee) instead of a chip+signature even though it's been around for what, 20 years now?
Re:London's Oyster card: Are its days numbered? by tialaramex on Saturday September 11, 2021 @07:07AM (#28490953)
In general even if the card isn't contactless, a decent phone, which can perform contactless transactions, can be hooked to the same account anyway.

In fact I deliberately own a non-contactless credit card (from my good bank, who were happy to send me the non-contactless version when requested even though their default is contactless) and then enrolled that card in my phone so the phone can make contactless purchases.

Thus, my credit card can't be hijacked to do remote purchases because purchases with the card require a physical connection, and yet I can make fairly large card purchases contactlessly, because my phone vouches for them after I unlock it.

Re:London's Oyster card: Are its days numbered? by pfranz on Saturday September 11, 2021 @12:09PM (#28493093)
That is true, but even with a US card in the US, there are vague scenarios where ApplePay requires a signature[1]. So it's problematic using it for unmanned terminals when traveling. I've had trouble traveling internationally and wouldn't trust it taking mass transit without extra time or a backup option.

[1] https://www.macobserver.com/tmo/article/when-apple-pay-requi...

Re:London's Oyster card: Are its days numbered? by tialaramex on Saturday September 11, 2021 @12:33PM (#28493300)
Obviously TfL can't do anything about a US bank/ card issuer having policies that lose them money, but the turnstiles are aware that they have no (passenger accessible) inputs and so they do not ask for a signature.

EMV lets the card (or in this case maybe a phone) and the terminal (in this case a turnstile inside the station, or a reader on a bus) negotiate what to do, the issuer may not be involved since it's possible they'll agree the entire transaction needn't yet involve the issuer. This is related to one bug in EMV, you could intercede in the middle to tell the card "It's OK, no need for a PIN" and also tell the terminal, "Yes, the PIN supplied was correct" and since the terminal doesn't know the correct PIN you've now got a shim that allows you to use the wrong PIN with a stolen card†.

Anyway, TfL terminals aren't going to agree to signatures. So, if your card really does only work with a signature then you can't use the turnstiles, along with presumably many other modern conveniences.

† There are obvious technical fixes. But the fixes cost money, and fraud is a cost banks can pass to their customers, guess what happens next.

Re:London's Oyster card: Are its days numbered? by ace2358 on Friday September 10, 2021 @05:44PM (#28487238)
The purchase of credit can be linked for sure. But at least my trips can’t be tracked. I can say, use anyone’s travel card. Anyone can top up my card. I can top up with cash. Whatever. Each individual trip can’t be tied to a person.

We don’t want to lose this privacy because as mentioned. We’ll never get it back.

Re:London's Oyster card: Are its days numbered? by lozf on Saturday September 11, 2021 @06:51AM (#28490884)
> But at least my trips can’t be tracked.

Sorry to break it to you but I'm pretty sure that unless you're actively swapping Oyster cards with random strangers, the pattern of metadata of where and when that card enters and exits the Underground or Overground, or when it takes a bus ride (and the route number at least) can soon yield a useful collection of data points (which in turn can be cross-referenced with CCTV timestamps) for any "authority" that's interested in tracking you.

Re:London's Oyster card: Are its days numbered? by rwmj on Saturday September 11, 2021 @06:04AM (#28490731)
My Oyster is anonymous (ish, apart from surveillance). I only ever topped it up with cash.